thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/kotlin/seed-010.kt

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: Room database raw query with user-controlled string concatenation
-
-package com.example.db
-
-import androidx.room.RoomDatabase
-import androidx.sqlite.db.SupportSQLiteDatabase
-
-class ProductDao(private val db: SupportSQLiteDatabase) {
-    fun searchProducts(searchTerm: String, category: String): android.database.Cursor {
-        val query = "SELECT * FROM products WHERE name LIKE '%$searchTerm%' AND category = '$category'"
-        return db.query(query, null)
-    }
-
-    fun deleteByFilter(field: String, value: String): Int {
-        val sql = "DELETE FROM products WHERE $field = '$value'"
-        db.execSQL(sql)
-        return 1
-    }
-
-    fun updatePrice(productId: String, newPrice: String) {
-        val sql = "UPDATE products SET price = $newPrice WHERE id = '$productId'"
-        db.execSQL(sql)
-    }
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: Room database raw query with user-controlled string concatenation
+
+package com.example.db
+
+import androidx.room.RoomDatabase
+import androidx.sqlite.db.SupportSQLiteDatabase
+
+class ProductDao(private val db: SupportSQLiteDatabase) {
+    fun searchProducts(searchTerm: String, category: String): android.database.Cursor {
+        val query = "SELECT * FROM products WHERE name LIKE '%$searchTerm%' AND category = '$category'"
+        return db.query(query, null)
+    }
+
+    fun deleteByFilter(field: String, value: String): Int {
+        val sql = "DELETE FROM products WHERE $field = '$value'"
+        db.execSQL(sql)
+        return 1
+    }
+
+    fun updatePrice(productId: String, newPrice: String) {
+        val sql = "UPDATE products SET price = $newPrice WHERE id = '$productId'"
+        db.execSQL(sql)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-011.kt

@@ -1,22 +1,22 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: SQLite rawQuery with ORDER BY clause built from user input
-
-package com.example.db
-
-import android.database.sqlite.SQLiteDatabase
-
-class OrderRepository(private val db: SQLiteDatabase) {
-    fun getOrdersSorted(sortColumn: String, sortDir: String): android.database.Cursor {
-        // User-controlled ORDER BY — cannot be parameterized naively
-        val sql = "SELECT * FROM orders ORDER BY $sortColumn $sortDir"
-        return db.rawQuery(sql, null)
-    }
-
-    fun filterOrders(status: String, fromDate: String): android.database.Cursor {
-        val sql = "SELECT * FROM orders WHERE status = '$status' AND created_at >= '$fromDate'"
-        return db.rawQuery(sql, null)
-    }
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: SQLite rawQuery with ORDER BY clause built from user input
+
+package com.example.db
+
+import android.database.sqlite.SQLiteDatabase
+
+class OrderRepository(private val db: SQLiteDatabase) {
+    fun getOrdersSorted(sortColumn: String, sortDir: String): android.database.Cursor {
+        // User-controlled ORDER BY — cannot be parameterized naively
+        val sql = "SELECT * FROM orders ORDER BY $sortColumn $sortDir"
+        return db.rawQuery(sql, null)
+    }
+
+    fun filterOrders(status: String, fromDate: String): android.database.Cursor {
+        val sql = "SELECT * FROM orders WHERE status = '$status' AND created_at >= '$fromDate'"
+        return db.rawQuery(sql, null)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-012.kt

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: JDBC template with string-concatenated SQL in Android backend
-
-package com.example.backend
-
-import java.sql.Connection
-import java.sql.DriverManager
-
-class ReportService {
-    private val conn: Connection = DriverManager.getConnection("jdbc:sqlite:app.db")
-
-    fun getReportData(userId: String, reportType: String): List<Map<String, Any>> {
-        val sql = "SELECT * FROM reports WHERE user_id = '$userId' AND type = '$reportType'"
-        val stmt = conn.createStatement()
-        val rs = stmt.executeQuery(sql)
-        val results = mutableListOf<Map<String, Any>>()
-        while (rs.next()) {
-            results.add(mapOf("id" to rs.getString("id"), "data" to rs.getString("data")))
-        }
-        return results
-    }
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: JDBC template with string-concatenated SQL in Android backend
+
+package com.example.backend
+
+import java.sql.Connection
+import java.sql.DriverManager
+
+class ReportService {
+    private val conn: Connection = DriverManager.getConnection("jdbc:sqlite:app.db")
+
+    fun getReportData(userId: String, reportType: String): List<Map<String, Any>> {
+        val sql = "SELECT * FROM reports WHERE user_id = '$userId' AND type = '$reportType'"
+        val stmt = conn.createStatement()
+        val rs = stmt.executeQuery(sql)
+        val results = mutableListOf<Map<String, Any>>()
+        while (rs.next()) {
+            results.add(mapOf("id" to rs.getString("id"), "data" to rs.getString("data")))
+        }
+        return results
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-013.kt

@@ -1,30 +1,30 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: ContentProvider query with raw selection argument built from user input
-
-package com.example.provider
-
-import android.content.ContentProvider
-import android.content.ContentValues
-import android.database.Cursor
-import android.net.Uri
-
-class DataProvider : ContentProvider() {
-    override fun query(
-        uri: Uri, projection: Array<String>?, selection: String?,
-        selectionArgs: Array<String>?, sortOrder: String?
-    ): Cursor? {
-        val userId = uri.getQueryParameter("user_id")
-        val rawSelection = "user_id = '$userId' AND active = 1"
-        return database?.rawQuery("SELECT * FROM items WHERE $rawSelection", null)
-    }
-
-    private val database get() = context?.openOrCreateDatabase("app.db", 0, null)
-    override fun onCreate() = true
-    override fun getType(uri: Uri) = null
-    override fun insert(uri: Uri, values: ContentValues?) = null
-    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<String>?) = 0
-    override fun update(uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<String>?) = 0
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: ContentProvider query with raw selection argument built from user input
+
+package com.example.provider
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.database.Cursor
+import android.net.Uri
+
+class DataProvider : ContentProvider() {
+    override fun query(
+        uri: Uri, projection: Array<String>?, selection: String?,
+        selectionArgs: Array<String>?, sortOrder: String?
+    ): Cursor? {
+        val userId = uri.getQueryParameter("user_id")
+        val rawSelection = "user_id = '$userId' AND active = 1"
+        return database?.rawQuery("SELECT * FROM items WHERE $rawSelection", null)
+    }
+
+    private val database get() = context?.openOrCreateDatabase("app.db", 0, null)
+    override fun onCreate() = true
+    override fun getType(uri: Uri) = null
+    override fun insert(uri: Uri, values: ContentValues?) = null
+    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<String>?) = 0
+    override fun update(uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<String>?) = 0
+}

package/dist/packages/crucible/seeds/kotlin/seed-014.kt

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: high
-// language: kotlin
-// expected: SQL injection via Room @RawQuery with user-controlled SimpleSQLiteQuery
-
-package com.example.db
-
-import androidx.room.Dao
-import androidx.room.RawQuery
-import androidx.sqlite.db.SimpleSQLiteQuery
-import androidx.sqlite.db.SupportSQLiteQuery
-
-@Dao
-abstract class AnalyticsDao {
-    @RawQuery
-    abstract fun runRawQuery(query: SupportSQLiteQuery): List<Map<String, Any>>
-
-    fun getMetrics(dimension: String, filter: String): List<Map<String, Any>> {
-        val sql = "SELECT $dimension, COUNT(*) as cnt FROM events WHERE $filter GROUP BY $dimension"
-        return runRawQuery(SimpleSQLiteQuery(sql))
-    }
-
-    fun customReport(whereClause: String): List<Map<String, Any>> {
-        return runRawQuery(SimpleSQLiteQuery("SELECT * FROM analytics WHERE $whereClause"))
-    }
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: high
+// language: kotlin
+// expected: SQL injection via Room @RawQuery with user-controlled SimpleSQLiteQuery
+
+package com.example.db
+
+import androidx.room.Dao
+import androidx.room.RawQuery
+import androidx.sqlite.db.SimpleSQLiteQuery
+import androidx.sqlite.db.SupportSQLiteQuery
+
+@Dao
+abstract class AnalyticsDao {
+    @RawQuery
+    abstract fun runRawQuery(query: SupportSQLiteQuery): List<Map<String, Any>>
+
+    fun getMetrics(dimension: String, filter: String): List<Map<String, Any>> {
+        val sql = "SELECT $dimension, COUNT(*) as cnt FROM events WHERE $filter GROUP BY $dimension"
+        return runRawQuery(SimpleSQLiteQuery(sql))
+    }
+
+    fun customReport(whereClause: String): List<Map<String, Any>> {
+        return runRawQuery(SimpleSQLiteQuery("SELECT * FROM analytics WHERE $whereClause"))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-015.kt

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: Multi-table SQL built dynamically from unvalidated user-supplied table name
-
-package com.example.db
-
-import android.database.sqlite.SQLiteDatabase
-
-class DynamicQueryBuilder(private val db: SQLiteDatabase) {
-    fun queryTable(tableName: String, columnFilter: String, value: String): android.database.Cursor {
-        val sql = "SELECT * FROM $tableName WHERE $columnFilter = '$value'"
-        return db.rawQuery(sql, null)
-    }
-
-    fun countRows(tableName: String, condition: String): Int {
-        val cursor = db.rawQuery("SELECT COUNT(*) FROM $tableName WHERE $condition", null)
-        cursor.moveToFirst()
-        val count = cursor.getInt(0)
-        cursor.close()
-        return count
-    }
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: Multi-table SQL built dynamically from unvalidated user-supplied table name
+
+package com.example.db
+
+import android.database.sqlite.SQLiteDatabase
+
+class DynamicQueryBuilder(private val db: SQLiteDatabase) {
+    fun queryTable(tableName: String, columnFilter: String, value: String): android.database.Cursor {
+        val sql = "SELECT * FROM $tableName WHERE $columnFilter = '$value'"
+        return db.rawQuery(sql, null)
+    }
+
+    fun countRows(tableName: String, condition: String): Int {
+        val cursor = db.rawQuery("SELECT COUNT(*) FROM $tableName WHERE $condition", null)
+        cursor.moveToFirst()
+        val count = cursor.getInt(0)
+        cursor.close()
+        return count
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-016.kt

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: kotlin
-// expected: WebView.loadData with unsanitized user HTML content
-
-package com.example.ui
-
-import android.webkit.WebView
-import android.webkit.WebViewClient
-
-class HelpFragment {
-    private lateinit var webView: WebView
-
-    fun displayUserContent(userHtml: String) {
-        webView.settings.javaScriptEnabled = true
-        webView.loadData(userHtml, "text/html", "UTF-8")
-    }
-
-    fun loadUserProfile(name: String, bio: String) {
-        val html = "<html><body><h1>$name</h1><p>$bio</p></body></html>"
-        webView.loadData(html, "text/html", null)
-    }
-
-    fun renderTemplate(template: String, userInput: String): String {
-        return template.replace("{USER_INPUT}", userInput)
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: WebView.loadData with unsanitized user HTML content
+
+package com.example.ui
+
+import android.webkit.WebView
+import android.webkit.WebViewClient
+
+class HelpFragment {
+    private lateinit var webView: WebView
+
+    fun displayUserContent(userHtml: String) {
+        webView.settings.javaScriptEnabled = true
+        webView.loadData(userHtml, "text/html", "UTF-8")
+    }
+
+    fun loadUserProfile(name: String, bio: String) {
+        val html = "<html><body><h1>$name</h1><p>$bio</p></body></html>"
+        webView.loadData(html, "text/html", null)
+    }
+
+    fun renderTemplate(template: String, userInput: String): String {
+        return template.replace("{USER_INPUT}", userInput)
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-017.kt

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: kotlin
-// expected: addJavascriptInterface exposes arbitrary Java object to WebView JavaScript
-
-package com.example.ui
-
-import android.webkit.JavascriptInterface
-import android.webkit.WebView
-
-class WebAppInterface(private val handler: AppHandler) {
-    @JavascriptInterface
-    fun executeAction(action: String, payload: String): String {
-        return handler.handle(action, payload)
-    }
-
-    @JavascriptInterface
-    fun getUserData(key: String): String {
-        return handler.getData(key)
-    }
-
-    @JavascriptInterface
-    fun runNativeCode(command: String): Boolean {
-        return handler.executeNative(command)
-    }
-}
-
-fun setupWebView(webView: WebView, handler: AppHandler) {
-    webView.settings.javaScriptEnabled = true
-    webView.addJavascriptInterface(WebAppInterface(handler), "Android")
-    webView.addJavascriptInterface(handler, "NativeHandler")
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: addJavascriptInterface exposes arbitrary Java object to WebView JavaScript
+
+package com.example.ui
+
+import android.webkit.JavascriptInterface
+import android.webkit.WebView
+
+class WebAppInterface(private val handler: AppHandler) {
+    @JavascriptInterface
+    fun executeAction(action: String, payload: String): String {
+        return handler.handle(action, payload)
+    }
+
+    @JavascriptInterface
+    fun getUserData(key: String): String {
+        return handler.getData(key)
+    }
+
+    @JavascriptInterface
+    fun runNativeCode(command: String): Boolean {
+        return handler.executeNative(command)
+    }
+}
+
+fun setupWebView(webView: WebView, handler: AppHandler) {
+    webView.settings.javaScriptEnabled = true
+    webView.addJavascriptInterface(WebAppInterface(handler), "Android")
+    webView.addJavascriptInterface(handler, "NativeHandler")
+}

package/dist/packages/crucible/seeds/kotlin/seed-018.kt

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: kotlin
-// expected: WebView.loadUrl with javascript: scheme from user-controlled intent data
-
-package com.example.deeplink
-
-import android.app.Activity
-import android.webkit.WebView
-
-class DeepLinkActivity : Activity() {
-    private lateinit var webView: WebView
-
-    override fun onResume() {
-        super.onResume()
-        val url = intent.getStringExtra("url") ?: intent.data?.toString() ?: ""
-        webView.settings.javaScriptEnabled = true
-        webView.loadUrl(url)
-    }
-
-    fun handleExternalLink(link: String) {
-        if (link.isNotEmpty()) {
-            webView.loadUrl(link)
-        }
-    }
-
-    fun injectScript(script: String) {
-        webView.loadUrl("javascript:$script")
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: WebView.loadUrl with javascript: scheme from user-controlled intent data
+
+package com.example.deeplink
+
+import android.app.Activity
+import android.webkit.WebView
+
+class DeepLinkActivity : Activity() {
+    private lateinit var webView: WebView
+
+    override fun onResume() {
+        super.onResume()
+        val url = intent.getStringExtra("url") ?: intent.data?.toString() ?: ""
+        webView.settings.javaScriptEnabled = true
+        webView.loadUrl(url)
+    }
+
+    fun handleExternalLink(link: String) {
+        if (link.isNotEmpty()) {
+            webView.loadUrl(link)
+        }
+    }
+
+    fun injectScript(script: String) {
+        webView.loadUrl("javascript:$script")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-019.kt

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: medium
-// language: kotlin
-// expected: WebView evaluateJavascript with unsanitized user string
-
-package com.example.ui
-
-import android.webkit.WebView
-
-class DashboardFragment {
-    private lateinit var webView: WebView
-
-    fun updateChart(jsonData: String) {
-        webView.settings.javaScriptEnabled = true
-        webView.evaluateJavascript("updateChart($jsonData)", null)
-    }
-
-    fun setUserName(name: String) {
-        webView.evaluateJavascript("document.getElementById('name').innerHTML = '$name'", null)
-    }
-
-    fun executeUserScript(script: String) {
-        webView.evaluateJavascript(script) { result ->
-            println("Script result: $result")
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: medium
+// language: kotlin
+// expected: WebView evaluateJavascript with unsanitized user string
+
+package com.example.ui
+
+import android.webkit.WebView
+
+class DashboardFragment {
+    private lateinit var webView: WebView
+
+    fun updateChart(jsonData: String) {
+        webView.settings.javaScriptEnabled = true
+        webView.evaluateJavascript("updateChart($jsonData)", null)
+    }
+
+    fun setUserName(name: String) {
+        webView.evaluateJavascript("document.getElementById('name').innerHTML = '$name'", null)
+    }
+
+    fun executeUserScript(script: String) {
+        webView.evaluateJavascript(script) { result ->
+            println("Script result: $result")
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-020.kt

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: xss
-// severity: high
-// language: kotlin
-// expected: WebView.loadDataWithBaseURL with user-controlled base URL and unescaped content
-
-package com.example.browser
-
-import android.webkit.WebView
-
-class ArticleViewer {
-    private lateinit var webView: WebView
-
-    fun displayArticle(baseUrl: String, content: String, title: String) {
-        val html = """
-            <html>
-            <head><title>$title</title></head>
-            <body>$content</body>
-            </html>
-        """.trimIndent()
-        webView.settings.javaScriptEnabled = true
-        webView.loadDataWithBaseURL(baseUrl, html, "text/html", "UTF-8", null)
-    }
-
-    fun renderMarkdown(userMarkdown: String) {
-        val html = "<html><body>${convertToHtml(userMarkdown)}</body></html>"
-        webView.loadDataWithBaseURL("https://trusted.example.com", html, "text/html", "UTF-8", null)
-    }
-
-    private fun convertToHtml(md: String) = md
-}
+// [CRUCIBLE-SEED]
+// category: xss
+// severity: high
+// language: kotlin
+// expected: WebView.loadDataWithBaseURL with user-controlled base URL and unescaped content
+
+package com.example.browser
+
+import android.webkit.WebView
+
+class ArticleViewer {
+    private lateinit var webView: WebView
+
+    fun displayArticle(baseUrl: String, content: String, title: String) {
+        val html = """
+            <html>
+            <head><title>$title</title></head>
+            <body>$content</body>
+            </html>
+        """.trimIndent()
+        webView.settings.javaScriptEnabled = true
+        webView.loadDataWithBaseURL(baseUrl, html, "text/html", "UTF-8", null)
+    }
+
+    fun renderMarkdown(userMarkdown: String) {
+        val html = "<html><body>${convertToHtml(userMarkdown)}</body></html>"
+        webView.loadDataWithBaseURL("https://trusted.example.com", html, "text/html", "UTF-8", null)
+    }
+
+    private fun convertToHtml(md: String) = md
+}